Analysis
-
max time kernel
84s -
max time network
141s -
platform
windows10-2004_x64 -
resource
win10v2004-20220812-en -
resource tags
-
submitted
17-11-2022 15:18
General
-
Target
LO30.iso
-
Size
848KB
-
MD5
ea66dc4ed9a8b6bdc468355bea047eb2
-
SHA1
c257365c246ecbfea389e2a93551a91b608f1c95
-
SHA256
2b3c1cbe5454771e83d7f7a8571ed08a5e23ade79acb9596527a5bc5353351d1
-
SHA512
e80e568ac5efb8fd0f731940c7b432513ef498d833e431853cd080cfd348292bcd1f9ce5dcfc2f9bfab2d31f3570f96fb7c05f92d47834c7eb48c222093ae0da
-
SSDEEP
12288:xoDjGfBlhYUWlaVxbYUGOpGPq1Tu/VxdZlUP9Xq4F/9QVN9:xoDjkzW8wWpD9u/VLM9Xq4nQVN9
Score
3/10
Malware Config
Signatures
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Modifies registry class 1 IoCs
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes
-
C:\Windows\system32\cmd.execmd /c C:\Users\Admin\AppData\Local\Temp\LO30.iso1⤵
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken